Along with continuous development of business, the scale and complexity of the Internet system increase continuously. How to fast and accurately find abnormity and pinpoint the problem becomes a very challenging task. At present, a popular method is to monitor certain external indicators capable of reflecting the system status, for example, the number of user click responses from a search engine, the number of user uploaded and posted messages to forum and microblog sites, and log data generated in an operation process of the server. These indicators are closely associated with user behaviors, able to reflect the operation condition of a machine or service, and have a specific change rule. If the indicator data do not accord with a normal change rule, it is an indication that the user behavior is abnormal or the system has a fault.
In the Internet system, such monitoring data have a huge volume and excessive types. It is unrealistic to solely rely on the operation and maintenance personnel to find whether the data are abnormal through manual monitoring. Therefore, an expected normal value of the current data is acquired through a year over year or same period calculations, the expected normal value is subtracted from the current normal value to produce a delta value, and a threshold is set for the delta value to implement automatic monitoring. However, this approach is difficult to meet the monitoring requirements on dramatically changing indicators and an inconsistent change rule appears. For example, the user behavior of searching and clicking advertisement links is affected by time and dates such as day and night, working days and weekends, statutory holidays (Tomb-sweeping Day, Dragon Boat Festival, International Labor Day, Mid-Autumn Festival, National Day and Spring Festival), newly-developing holidays (Valentine's Day, Christmas, November, 11, etc.), leading to a suboptimal detection result.
Regarding the above problem, one possible solution is to depend on the experience of the operation and maintenance personnel to frequently adjust the threshold of the monitored items. However, such operation will increase the monitoring cost, in addition, not all monitored items can be adjusted in real time due to limited manpower and experience. Therefore, the operation and maintenance personnel hope to auto-adaptively forecast the data of monitored items, thus reducing the excessive dependence on manually monitored monitoring on manual supervision.